Allocation of Resources Without Limits or Throttling in Apache Commons FileUpload - CVE-2023-24998

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU72427

Allocation of Resources Without Limits or Throttling in Apache Commons FileUpload - CVE-2023-24998

Published: February 20, 2023 / Updated: May 23, 2024


Vulnerability identifier: #VU72427
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-24998
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to Apache Commons FileUpload does not limit the number of request parts. A remote attacker can initiate a series of uploads and perform a denial of service (DoS) attack.


Affected software

Apache Commons FileUpload
WebSphere Service Registry and Repository
IBM Integration Bus
IBM Process Mining
Crucible Data Center
Crucible Server
IBM Intelligent Operations Center
Dell Secure Connect Gateway
IBM Sterling B2B Integrator
IBM Rational Build Forge
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
Oracle Financial Services Behavior Detection Platform
IBM Tivoli Netcool/OMNIbus WebGUI
Oracle Financial Services Model Management and Governance
Bamboo Server
IBM Common Licensing
IBM Transformation Extender Advanced
Oracle Communications Session Report Manager
IBM Workload Scheduler
Oracle Middleware Common Libraries and Tools
Middleware Common Libraries and Tools
IBM Cloud Pak for Business Automation
Oracle Banking APIs
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications EAGLE Element Management System
IBM Cloud Pak for Data System
Jazz for Service Management
IBM Cloud Application Business Insights
Netcool Operations Insight
IBM Cloud Pak for Multicloud Management Monitoring
IBM Spectrum Conductor
Financial Transaction Manager for Digital Payments (DP)
Financial Transaction Manager for Corporate Payment Services (CPS)
IBM Cloud Transformation Advisor
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Match 360
IBM Spectrum Scale for IBM Elastic Storage Server
IBM Spectrum Control
IBM Sterling Secure Proxy
IBM Elastic Storage System
IBM Sterling Partner Engagement Manager
IBM Sterling Control Center
IBM Tivoli Business Service Manager
IBM UrbanCode Release
UCD - IBM UrbanCode Deploy
IBM Tivoli Monitoring
IBM Tivoli Netcool Impact
IBM Spectrum Symphony
IBM Cloud Application Performance Management (APM)
IBM Maximo Asset Management
IBM TXSeries for Multiplatforms
IBM Maximo Application Suite
CICS Transaction Gateway
IBM MQ
IBM Power Hardware Management Console (HMC)
IBM Security Verify Governance
IBM Spectrum Protect Plus
InfoSphere Master Data Management
NetWorker
IBM Business Automation Workflow
IBM Robotic Process Automation
IBM Automation Decision Services
IBM Tivoli Application Dependency Discovery Manager
IBM Data Risk Manager
IBM Db2 Web Query for i
Oracle Utilities Application Framework
Rational Change
Oracle Financial Services Compliance Studio
Oracle Communications Element Manager
Oracle Business Process Management Suite
Oracle Fusion Middleware MapViewer
Oracle SOA Suite
Oracle Banking Corporate Lending Process Management
Oracle Banking Trade Finance Process Management
Oracle Banking Branch
Oracle Banking Origination
Oracle Banking Liquidity Management
Oracle Banking Supply Chain Finance
Oracle Banking Cash Management
Oracle Banking Credit Facilities Process Management
Oracle Retail Bulk Data Integration
Siebel Apps
SAP Quotation Management Insurance (FS-QUO)
IBM Integrated Analytics System
Amazon Linux AMI
Debian Linux
Oracle Linux
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE CaaS Platform
Oracle Solaris Cluster
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
IBM i
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Oracle Solaris
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server 12 SP4 LTSS
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Web and Scripting Module
openSUSE Leap
openEuler
Spectrum Sentinel Anomaly Scan Engine
Library Support for Struts
Oracle Agile Engineering Data Management
Oracle Transportation Management
Oracle BI Publisher
Oracle Financial Services Analytical Applications Infrastructure
IBM OpenPages with Watson
Business Monitor
IBM Engineering Requirements Management DOORS Next
IBM Security Verify Bridge for Directory Sync
webMethods developer portal
Oracle Policy Automation
Oracle Business Intelligence Enterprise Edition
Oracle Data Integrator
Oracle Application Testing Suite
Oracle Retail Service Backbone
Oracle Retail Store Inventory Management
Oracle Retail Xstore Point of Service
Oracle Banking Digital Experience
Oracle Retail Order Broker
Integration Designer
IBM i Modernization Engine for Lifecycle Integration
IBM Planning Analytics Workspace
eDiscovery Manager
Storage Copy Data Management
Cloud Pak for Network Automation
UrbanCode Build
MobileFirst Platform
IBM Security Directory Suite
Storage Protect Operations Center
Storage Protect Server
Maximo Data Loader
IBM Virtualization Engine TS7700 3948-VED
Datacap
IBM MQ Appliance
IBM Sterling Order Management
Robotic Process Automation for Cloud Pak
Jenkins
Jenkins LTS
Oracle WebLogic Server
IBM WebSphere Application Server
IBM WebSphere Application Server Liberty
Oracle Communications Convergence
Communications Unified Assurance
Oracle Communications Calendar Server
Oracle Communications Contacts Server
Voice Gateway
Oracle Financial Services Revenue Management and Billing
IBM App Connect for Healthcare
Unified Data Protection
IBM Cognos Controller
Oracle FLEXCUBE Core Banking
Cloud Pak for Security (CP4S)
Financial Transaction Manager
Jazz Reporting Service
IBM Qradar SIEM
SecureTransport
JBoss Web Server
Apache Tomcat
Oracle Communications Order and Service Management
IBM App Connect Professional
Primavera Unifier
IBM Watson Explorer Foundational Components Annotation Administration Console
IBM Watson Explorer Deep Analytics Edition oneWEX
IBM Watson Explorer Deep Analytics Edition Analytical Components
Watson Explorer Deep Analytics Edition Foundational Components Annotation Administration Console
MySQL Enterprise Monitor
Oracle Database Server
IBM InfoSphere Information Server
Oracle Agile PLM Framework
Red Hat Camel for Spring Boot
IBM CICS TX Advanced
IBM CICS TX Standard
Oracle REST Data Services
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Retail Customer Management and Segmentation Foundation
Identity Manager
IBM Security Verify Access
IBM DS8000 Hardware Management Console
Oracle Service Bus
Oracle Documaker
Planning Analytics Local
Operational Decision Manager
Oracle Retail Integration Bus
Oracle Spatial Studio
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Tomcat
jakarta-commons-fileupload-javadoc
jakarta-commons-fileupload
jws5-tomcat-native (Red Hat package)
apache-commons-fileupload-help
apache-commons-fileupload
apache-commons-fileupload-javadoc
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)
tomcat-servlet-3_1-api
tomcat
tomcat-lib
tomcat-docs-webapp
tomcat-el-3_0-api
tomcat-webapps
tomcat-admin-webapps
tomcat-javadoc
tomcat-jsp-2_3-api
tomcat8
tomcat-help
tomcat-jsvc
tomcat-servlet-4_0-api
tomcat9 (Debian package)
tomcat-embed
jws5-tomcat (Red Hat package)
tomcat (Red Hat package)
tomcat-el-3.0-api
tomcat-jsp-2.3-api
tomcat-servlet-4.0-api
tomcat9
www-servers/tomcat
IBM Cloud Pak System
IBM Content Navigator
Liberty for Java for IBM Cloud
EMC ViPR SRM
Dell EMC Storage Monitoring and Reporting (SMR)
HPE IceWall Identity Manager
IBM Rational Asset Manager
RecoverPoint for VMs
Virtualization Engine TS7700 3957-VED
Virtualization Engine TS7700 3957-VEC
IBM Security SOAR

How to mitigate CVE-2023-24998

Install update from vendor's website.

Apache Commons FileUpload - update to 1.5
Spectrum Sentinel Anomaly Scan Engine - update to 1.1.4
IBM Process Mining - update to 1.14.0.0
Jenkins - update to 2.394
IBM Data Risk Manager - update to 2.0.6.18
Jenkins LTS - addressed in versions 2.375.4, 2.387.1
Crucible Data Center - update to 4.9.10
Crucible Server - update to 4.9.10
IBM Intelligent Operations Center - update to 5.2.4
Rational Change - update to 5.3.2.6
SecureTransport - addressed in versions 5.5-20230330, 5.5-20230629
Communications Unified Assurance - update to 5.5.17
JBoss Web Server - update to 5.7.4
Dell Secure Connect Gateway - update to 5.16
IBM Sterling B2B Integrator - addressed in versions 6.0.3.9, 6.1.0.8, 6.1.2.3, 6.2.0.0
Unified Data Protection - update to 9.1
IBM Rational Build Forge - update to 8.0.0.24
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.30
Bamboo Server - addressed in versions 9.2.4, 9.3.1
Apache Tomcat - addressed in versions 8.5.85, 9.0.71, 10.1.5, 11.0.0-M3
IBM Workload Scheduler - addressed in versions 9.5.0.6, 10.1.0.2
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
IBM Cognos Controller - update to 11.0.1.0.3
webMethods developer portal - update to 11.1.6
Oracle FLEXCUBE Core Banking - update to 11.8.0
Oracle Policy Automation - update to 12.2.30
Oracle Banking Corporate Lending Process Management - update to 14.7.0.0.0
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.20, 22.0.2.4
Tomcat - update to D.9.0.87.01
IBM Cloud Pak for Data System - update to 1.0.8.2
Voice Gateway - addressed in versions 1.0.8.4, 1.0.8.7, 1.0.8.9
IBM Integrated Analytics System - update to 1.0.28.1
jakarta-commons-fileupload-javadoc - addressed in versions 1.1.1-122.8.1, 1.1.1-150000.4.8.1
jakarta-commons-fileupload - addressed in versions 1.1.1-122.8.1, 1.1.1-150000.4.8.1
Jazz for Service Management - update to 1.1.3.17
IBM Cloud Application Business Insights - addressed in versions 1.1.7.7, 1.1.8.1
jws5-tomcat-native (Red Hat package) - addressed in versions 1.2.31-15.redhat_15.el7jws, 1.2.31-15.redhat_15.el8jws, 1.2.31-15.redhat_15.el9jws
apache-commons-fileupload-help - update to 1.4-2
apache-commons-fileupload - update to 1.4-2
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.2
apache-commons-fileupload-javadoc - update to 1.5-150200.3.9.1
apache-commons-fileupload - update to 1.5-150200.3.9.1
Netcool Operations Insight - update to 1.6.9
Cloud Pak for Security (CP4S) - update to 1.10.12.0
Planning Analytics Local - update to 2.0.9.19
IBM Planning Analytics Workspace - update to 2.0.91
eDiscovery Manager - update to 2.2.2.3
Storage Copy Data Management - update to 2.2.23.0
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 7
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
IBM Spectrum Conductor - update to 2.5.1 FP2
Cloud Pak for Network Automation - update to 2.7
jenkins (Red Hat package) - update to 2.387.3.1684911776-3.el8
IBM Content Navigator - addressed in versions 3.0.11.10, 3.0.12.6, 3.0.13.3
Financial Transaction Manager for Digital Payments (DP) - update to 3.2.11.1
Financial Transaction Manager for Corporate Payment Services (CPS) - update to 3.2.11.1
Financial Transaction Manager - update to 3.2.11.1
IBM Cloud Transformation Advisor - update to 3.5.2
Red Hat Camel for Spring Boot - update to 3.20.1
Liberty for Java for IBM Cloud - update to 4.0-20230421-1536
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.7
IBM Match 360 - update to 4.7.1
EMC ViPR SRM - update to 4.10.0.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.0
jenkins-2-plugins (Red Hat package) - update to 4.13.1684911916-1.el8
HPE IceWall Identity Manager - addressed in versions 5.0 Patch 6, 6.0 Patch 3
IBM Spectrum Scale for IBM Elastic Storage Server - addressed in versions 5.1.2.11, 5.1.8.0
IBM Spectrum Control - update to 5.4.10.1
RecoverPoint for VMs - update to 6.0.SP1.P1
IBM Sterling Secure Proxy - update to 6.0.3 iFix 08
IBM Elastic Storage System - addressed in versions 6.1.2.7, 6.1.8.1
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.8, 6.2.0.6, 6.2.1.3, 6.2.2.1
IBM Sterling Control Center - addressed in versions 6.1.3.0.16, 6.2.1.0.11, 6.3.0.0.2
UrbanCode Build - update to 6.1.7.9
IBM Tivoli Business Service Manager - update to 6.2.0.5
IBM UrbanCode Release - update to 6.2.5.11
UCD - IBM UrbanCode Deploy - addressed in versions 6.2.7.20, 7.0.5.15, 7.1.2.11, 7.2.3.4, 7.3.1.0
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
Jazz Reporting Service - update to 7.0.2 iFix026
IBM Tivoli Netcool Impact - update to 7.1.0.29
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
IBM Rational Asset Manager - update to 7.5.4.15
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202304111626
IBM Security Directory Suite - update to 8.0.1.21
tomcat-servlet-3_1-api - addressed in versions 8.0.53-29.63.1, 8.0.53-29.66.1
tomcat - addressed in versions 8.0.53-29.63.1, 8.0.53-29.66.1, 9.0.36-3.99.1, 9.0.36-3.105.1, 9.0.36-150100.4.87.1, 9.0.36-150100.4.93.1, 9.0.43-150200.35.1, 9.0.75-150200.41.1
tomcat-lib - addressed in versions 8.0.53-29.63.1, 8.0.53-29.66.1, 9.0.36-3.99.1, 9.0.36-3.105.1, 9.0.36-150100.4.87.1, 9.0.36-150100.4.93.1, 9.0.43-150200.35.1, 9.0.75-150200.41.1
tomcat-docs-webapp - addressed in versions 8.0.53-29.63.1, 8.0.53-29.66.1, 9.0.36-3.99.1, 9.0.36-3.105.1, 9.0.43-150200.35.1, 9.0.75-150200.41.1
tomcat-el-3_0-api - addressed in versions 8.0.53-29.63.1, 8.0.53-29.66.1, 9.0.36-3.99.1, 9.0.36-3.105.1, 9.0.36-150100.4.87.1, 9.0.36-150100.4.93.1, 9.0.43-150200.35.1, 9.0.75-150200.41.1
tomcat-webapps - addressed in versions 8.0.53-29.63.1, 8.0.53-29.66.1, 9.0.36-3.99.1, 9.0.36-3.105.1, 9.0.36-150100.4.87.1, 9.0.36-150100.4.93.1, 9.0.43-150200.35.1, 9.0.75-150200.41.1
tomcat-admin-webapps - addressed in versions 8.0.53-29.63.1, 8.0.53-29.66.1, 9.0.36-3.99.1, 9.0.36-3.105.1, 9.0.36-150100.4.87.1, 9.0.36-150100.4.93.1, 9.0.43-150200.35.1, 9.0.75-150200.41.1
tomcat-javadoc - addressed in versions 8.0.53-29.63.1, 8.0.53-29.66.1, 9.0.36-3.99.1, 9.0.36-3.105.1, 9.0.43-150200.35.1, 9.0.75-150200.41.1
tomcat-jsp-2_3-api - addressed in versions 8.0.53-29.63.1, 8.0.53-29.66.1, 9.0.36-3.99.1, 9.0.36-3.105.1, 9.0.36-150100.4.87.1, 9.0.36-150100.4.93.1, 9.0.43-150200.35.1, 9.0.75-150200.41.1
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
IBM Maximo Asset Management - addressed in versions 8.1.10, 9.0.6
Storage Protect Operations Center - update to 8.1.19
Storage Protect Server - update to 8.1.19
IBM TXSeries for Multiplatforms - addressed in versions 8.2.0.2, 9.1.0.2
Maximo Data Loader - update to 8.5.0
IBM WebSphere Application Server - addressed in versions 8.5.5.24, 9.0.5.16
tomcat8 - addressed in versions 8.5.89-1.93, 8.5.93-1.94
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.4
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 33, 8.11.0.1 Interim fix 15, 8.11.1 Interim fix 4
Virtualization Engine TS7700 3957-VED - addressed in versions 8.52.103.23 VTD_EXEC.901, 8.53.1.21 VTD_EXEC.903
Virtualization Engine TS7700 3957-VEC - update to 8.52.103.23 VTD_EXEC.901
IBM Virtualization Engine TS7700 3948-VED - update to 8.53.1.21 VTD_EXEC.903
tomcat-help - update to 9.0.10-31
tomcat - update to 9.0.10-31
tomcat-jsvc - update to 9.0.10-31
tomcat-servlet-4_0-api - addressed in versions 9.0.36-3.99.1, 9.0.36-3.105.1, 9.0.36-150100.4.87.1, 9.0.36-150100.4.93.1, 9.0.43-150200.35.1, 9.0.75-150200.41.1
tomcat9 (Debian package) - update to 9.0.43-2~deb11u7
tomcat-embed - addressed in versions 9.0.43-150200.35.1, 9.0.75-150200.41.1
tomcat-jsvc - addressed in versions 9.0.43-150200.35.1, 9.0.75-150200.41.1
jws5-tomcat (Red Hat package) - addressed in versions 9.0.62-15.redhat_00013.1.el7jws, 9.0.62-15.redhat_00013.1.el8jws, 9.0.62-15.redhat_00013.1.el9jws
tomcat (Red Hat package) - addressed in versions 9.0.62-27.el8_9, 9.0.62-37.el9_3
tomcat - update to 9.0.62-30
tomcat-admin-webapps - update to 9.0.62-30
tomcat-docs-webapp - update to 9.0.62-30
tomcat-el-3.0-api - update to 9.0.62-30
tomcat-jsp-2.3-api - update to 9.0.62-30
tomcat-lib - update to 9.0.62-30
tomcat-webapps - update to 9.0.62-30
tomcat-servlet-4.0-api - update to 9.0.62-30
tomcat9 - update to 9.0.71-1
CICS Transaction Gateway - addressed in versions 9.1.0.3, 9.2.0.2, 9.3.0.0
IBM MQ - addressed in versions 9.1.0.16, 9.2.0.15, 9.3.0.6, 9.3.3
Datacap - update to 9.1.9.0.4
IBM MQ Appliance - addressed in versions 9.2.0.15, 9.2.5.8, 9.3.0.6, 9.3.3
IBM Power Hardware Management Console (HMC) - addressed in versions 9.2.950.0 SP3, 10.1.1020.0 SP1, 10.2.1030.0, 10.2.1030.0 SP1
IBM Security Verify Governance - update to 10.0.1.0.4
IBM Security Verify Access - update to 10.0.5.0 FP001
IBM Sterling Order Management - update to 10.0.2309.0
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix16, 11.1.0.0 ifix9
www-servers/tomcat - update to 10.1.8
IBM Spectrum Protect Plus - update to 10.1.15
IBM Watson Explorer Foundational Components Annotation Administration Console - update to 11.0.2.15
IBM CICS TX Standard - update to 11.1.0.0 ifix9
InfoSphere Master Data Management - addressed in versions 11.6.0.12 IF003, 12.0.0.0 IF006, 14.0.0.0 IF001
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
IBM Watson Explorer Deep Analytics Edition oneWEX - update to 12.0.3.11
IBM Watson Explorer Deep Analytics Edition Analytical Components - update to 12.0.3.11
Watson Explorer Deep Analytics Edition Foundational Components Annotation Administration Console - update to 12.0.3.11
NetWorker - update to 19.9.0.1
IBM Business Automation Workflow - addressed in versions 21.0.3 IF020, 22.0.2 IF004
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.6, 23.0.6
IBM Robotic Process Automation - addressed in versions 21.0.7.6, 23.0.6
IBM WebSphere Application Server Liberty - update to 23.0.0.4
IBM Automation Decision Services - update to 23.0.1 IF003
Oracle REST Data Services - update to 23.1.0
IBM Security SOAR - update to 49.1
IBM DS8000 Hardware Management Console - update to 89.33.34.0

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins